KB4594440 doesn't seem to quite resolve this, at least for me. The problem still
persists unless I set PerformTicketSignature to 0 on DC's. As I understand, this will
not be possible when the change becomes mandatory in a few months. I'm trying to get a
hold of someone at Microsoft via my company's support contract.